Security you can check yourself.
Stockimus runs on a small set of contracts with no admin path to your stock. This page lists what the test suite proves, how the whole lifecycle is rehearsed on a fork of Robinhood Chain before anything is deployed, the safeguards written into the code, and how to report a bug. Every claim here points at a test, a constant or a function you can read.
01What is tested
Counts are for contracts/test. The vault, accountant, token, factory and oracle suites were ported unchanged in logic from the code they were written for; the pool helper has suites of its own. The 19 regression tests are among the 189: each one fails on the code before its fix and passes after it. The pool helper's invariants run twice, once for each order of the two tokens in the pool. Run everything with forge test in contracts/.
02Scope
Before this site existed the same code went through an internal adversarial review: findings in the vault, accountant, oracle and deploy scripts were fixed, and every contract finding left a regression test behind. That review is not an independent firm's report and is not presented as one.
03How a release is checked
The suite and the fork. forge test runs every suite above. The fork rehearsal deploys the factory, 14 accountants and 4 series on a copy of Robinhood Chain, buys stock with ETH, splits and merges, seeds pools, trades, opens a lending market, books a dividend, then settles and redeems both halves, asserting balances after each step.
One script, nothing hidden. deploy.sh runs the tests again, prints the plan, simulates against the live chain and checks the gas, and only broadcasts after the word deploy is typed. It reads every contract back, submits the source to Sourcify and writes the record this site reads.
Read it on chain. The explorer shows each verified source. Addresses are published in /contracts.json and /llms.txt, and the accountants report their state on the oracle page. Bug reports go to @PayStockimus.
04Safeguards in the code
Each of these is a rule the contracts enforce, not a promise. The docs give the exact numbers in section 11.
No admin path to your stock. Stock leaves a vault only through merge, redemption and the two fees. No function lets the owner, the guardian or anyone else move a vault's stock or mint tokens, and nothing is upgradeable.
The exit is always open. Merge works while active, after maturity and after settlement. Pausing a vault and its deposit cap only affect new splits.
Each series holds a bounded amount. The first series cap stock at 770 AAPL, 330 SPY, 350 QQQ and 9,100 PFE. The owner can change a cap; a cap of 0 closes new splits.
New splits can be paused per vault. It is the owner's one brake, and it cannot touch merge, settlement or redemption.
Nobody can raise your fee. A vault copies its split and yield fee at creation and keeps them for life. Future fees are capped at 50 bps and 10%.
The guardian is bounded and slow. It can only book a ratio that explains the move, never above 1.2, after a public 2 day timelock, and it can be outwaited: after 14 days anyone books the default. A new guardian takes over 3 days after it is named.
No key needed at maturity. Anyone can settle once maturity passes. If the stock token stops answering, the series settles on the booked index 30 days after maturity.
Balances, not promises. Every transfer in is checked by balance delta, every state change is reentrancy guarded, and every division rounds in the vault's favour.
Two steps to hand over, none to abandon. Ownership moves in two steps and cannot be renounced, so a lost guardian or a refused treasury can always be replaced.
A refused fee never blocks you. If the stock token will not pay the treasury, the fee waits in the vault and anyone can send it on later.
05Every test suite
| SUITE | WHAT IT PROVES | KIND | TESTS |
|---|---|---|---|
| StockimusLP | The pool helper both ways round: deposits with the pToken as either pool token, quote-limited and principal-only ranges with refunds, unknown vaults and wrong quotes refused, minimums and deadlines, reentry refused, an approved position withdrawable only by its owner, fees collected, exits after maturity and settlement; two fuzzed round trips account for every wei. | UNIT | 46 |
| StockimusAccountant | Dividend band edges (tiny, exactly 3%, 3% plus 1 wei), downward moves, splits 2:1, 3:2, 1:10, 7:1 and 50:1, the queue and its overflow, resolutions bound to the move, the timelock, cancel, permissionless execute, dating by effectiveAt, the index history. | UNIT | 39 |
| StockimusVault | Split, fee, cap and pause; fee-on-transfer and reentrant tokens; merge in every state and after partial redemptions; settle before maturity and while unsynced; dT frozen; exact redemptions; the fee only on the drip; rounding. | UNIT | 27 |
| StockimusFactory | Defaults, access control, accountant and series creation, names and symbols for all four tags, tag and maturity checks, the minimum term, fees only for later series, delayed guardian changes, renounce disabled, two step ownership. | UNIT | 19 |
| StockimusReview | One regression per contract finding of the internal review: oracle pricing independent of the pool, guardian bounds, settlement never blocked by later moves, dates across maturity, issuer corrections, previews matching settlement. | REGRESSION | 19 |
| StockimusPtOracle | Principal value while active, matured and settled; the discount; waiting rises; split-sized moves and a feed older than the split; stale and non-positive feeds; the 1e36 scale; the pool never moving the price. | UNIT | 16 |
| StockimusScripts | The seed planner refusing squatted pools, and the market preflight refusing a wrong feed, a dust pool, a small observation ring and non-default values; the launch plan of four series on one maturity. | UNIT | 10 |
| StockimusLibraries | Tag parsing, calendar maths fuzzed against day counting, tick to price. | FUZZ | 7 |
| StockimusFuzz | Split then merge returns the amount minus the fee; principal out plus yield gross equals the amount to the wei below; chunked redemptions never overpay. | FUZZ | 3 |
| StockimusToken | Mint and burn by the vault only, the two kinds, permit and its signing domain. | UNIT | 3 |
| StockimusInvariant | A handler drives splits, merges, transfers, dividends, time, settlement and redemptions: the stock always covers every claim, bookkeeping equals balance, every share is accounted for, dT stays frozen. | INVARIANT | 4 |
| StockimusLPInvariant | Random deposits, withdrawals and transfers through the pool helper: it never holds anything, the vault backs both halves, stock is conserved, positions hold their tokens, and nobody withdraws a position that is not theirs. | INVARIANT | 5 |
| StockimusLPFork | The pool helper on a fork of Robinhood Chain against the real position manager, PFE and USDG: deposit, trade through the pool, withdraw, with the pToken as either pool token. | FORK | 2 |
Suite names drop the .t.sol ending. The fork rehearsal is a script of its own, script/fork-e2e.sh, and its eight stages assert every balance against the node's own logs.
06The pool helper
StockimusLP turns stock and USDG into a pPFE/USDG position in one deposit and back in one withdrawal. It has no owner, no fee and no upgrade path, and it checks the following on every call.
07The lending price, and known limits
The pool never sets a loan's price. StockimusPtOracle values a pToken as the stock feed times what it redeems for, discounted for the time left and capped at one share, so a pool pushed around for a few seconds cannot trigger a liquidation.
It refuses old data. The price reverts when the feed is older than 5 days, older than the latest booked split, or not positive, and while an unbooked move is the size of a split.
A market opens only on real depth. create-market.sh checks the feed, the pool depth, the observation ring and 30 minutes of price history, and that the market uses Morpho Blue with a 62.5% LLTV and the Adaptive Curve IRM.
A multiplier move nobody observed between the accountant's last look and a maturity is counted before that maturity. One sync() or settle() at each maturity keeps later moves on the right side.
For moves between 3% and 20%, the guardian still chooses between no dividend and the whole move, in public and behind the timelock. A multisig separate from the deployer is the right holder.
The freshness rule trusts the price feed to publish a round after a split, and allows 5 days so weekends and long holidays do not halt the market. Chain 4663 has no sequencer uptime feed to check.
The issuer can pause or upgrade its stock token. The fallbacks keep holders able to leave; they cannot make an arbitrary upgrade harmless.
08Report a bug
Send a direct message to @PayStockimus on X. Please do not post an exploitable bug in public before it is fixed.
The contract and function, what goes wrong, and the steps to reproduce it: a Foundry test or a transaction on a fork is ideal. A real transaction hash helps when there is one.
The report is read, reproduced and answered. Merge stays open throughout, so holders can always leave while a fix is prepared.